Put Your Website Behind Shieldify.

What you need

• Access to your DNS at your registrar or DNS provider, so you can add or change one record.
• Your server's address: the IP address or hostname where the website runs today. Shieldify calls this the origin.
• About ten minutes, plus the time your DNS provider needs to publish the change.

Lower the TTL of the record you are going to change to a few minutes a day before you switch. The move to Shieldify, and back if you ever need to, then takes effect quickly.

Create an account and start the trial

Create an account and sign in to the panel. When you add your first website you start a 1-day trial: add a payment method in Stripe Checkout, nothing is charged that day, and the €19.90 monthly subscription for that website begins after 24 hours unless you cancel. Each website has its own subscription. See pricing.

Add your website

1. Enter the domain, for example example.com. The panel checks that the domain exists and is not already protected.
2. Enter the origin: the IP address or hostname of your server. The protocol and port are detected automatically.
3. Choose www if www.example.com should be protected by the same website. Its DNS has to point to Shieldify too.

Point your DNS to Shieldify

At your DNS provider, point the hostname you added to shieldify.ee with a CNAME record:

The root domain (example.com without www) usually cannot hold a CNAME record. Most DNS providers offer an ALIAS, ANAME or CNAME flattening option for exactly this case; use it with the same target. If your provider has none of these, write to contact@shieldify.ee and we will help.

The panel checks the record and shows Pointed to shieldify.ee once it is visible. Depending on the old record's TTL this takes from a few minutes to a few hours.

Using Cloudflare DNS? Set the record's proxy status to DNS only (grey cloud). With the orange cloud, traffic would stop at Cloudflare and never reach Shieldify.

Get the SSL certificate

When the DNS points to Shieldify, a free certificate is issued for the website automatically and renewed before it expires. Under SSL and TLS you can switch on Force HTTPS so every visitor is moved to the secure address.

If issuance fails, the panel shows the reason. The usual cause is DNS that does not point to Shieldify yet; fix the record and retry from the same page.

Lock down your server

Shieldify can only protect traffic that goes through it. If attackers know your server's own address they can send requests to it directly and skip every check. Close that path:

• Allow only Shieldify on ports 80 and 443 in your server firewall or your hosting provider's network firewall. Write to contact@shieldify.ee for the current list of Shieldify addresses.
• Move to a new IP address if your old one was public for a long time. Old DNS records and history sites keep it findable.
• Check other records such as mail, ftp or dev that point to the same server and reveal its address.

Restore real visitor IP addresses

Behind Shieldify, your server sees requests coming from Shieldify. The visitor's own address is forwarded in three headers, so your logs, analytics and application can keep using it:

Tell your web server to trust these headers only from Shieldify's addresses. For nginx:

# http {} or server {} block; repeat set_real_ip_from for each Shieldify address
set_real_ip_from  SHIELDIFY_ADDRESS;
real_ip_header    X-Real-IP;

For Apache with mod_remoteip:

RemoteIPHeader         X-Real-IP
RemoteIPTrustedProxy   SHIELDIFY_ADDRESS

Never trust these headers from every address. Anyone could then send a fake visitor IP straight to your server.

Let APIs, webhooks and monitors through

During an attack, new visitors are asked for a browser check. Machine clients such as payment providers, webhooks, uptime monitors and mobile apps cannot complete it. Add them under Access rules before you need them:

• Trusted URI paths: an exact path such as /api/payment/callback, or a section with /* at the end, such as /api/webhooks/*.
• Trusted IP addresses: fixed addresses of payment providers, monitors, office VPNs or internal tools.

Keep rules narrow. A trusted path skips the first verification layer for everyone who requests it, so trust the callback, not the whole API, and avoid broad wildcards.

Protect admin areas

Under Zero Trust, add the paths that only your team should open, such as /wp-admin/* or /admin. Visitors to those paths enter their email address and request access; approved people receive a time-limited code. Use exact paths for single panels and /prefix/* for whole sections.

Set up alerts

Under Notifications, choose where protection events go: email, a Discord channel through a webhook, or both. You can turn each message on or off: attack wave started, attack wave ended, and automatic protection switching on and off. Attack alerts include the duration, peak blocking rate and total blocked requests.

Tune DDoS protection

The defaults suit most websites. Under DDoS and automatic mode you can change them:

Common problems

Still stuck? Write to contact@shieldify.ee with your domain and what you see, and a person will answer.